Implementing Authorization
1. Implementing Role-Based Access Control
| Component | Example |
|---|---|
| Roles | admin, editor, viewer |
| Permissions per role | Static mapping |
| User → Roles | Many-to-many |
| Pros | Simple, easy to audit |
| Cons | Role explosion at scale |
2. Implementing Attribute-Based Access Control
| Component | Example |
|---|---|
| Subject attrs | role, department, clearance |
| Resource attrs | owner, classification, region |
| Action | read, write, delete |
| Environment | time, IP, MFA status |
| Engines | OPA, Cedar, Casbin |
3. Implementing Resource-Level Permissions
Example: Resource-Level Check
@PreAuthorize("@orderSecurity.canAccess(authentication, #orderId)")
@GetMapping("/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId) {
return orderService.findById(orderId);
}4. Implementing Scope-Based Authorization
| Scope | Permits |
|---|---|
orders:read | GET on orders |
orders:write | POST/PUT/PATCH on orders |
orders:delete | DELETE on orders |
admin:* | Full admin access |
5. Validating Permissions Before Operations
| Layer | Check |
|---|---|
| Gateway | Coarse: scope, role |
| Controller | Endpoint-level annotation |
| Service | Business rules, ownership |
| Data | Row-level security (filter at query) |
6. Handling Forbidden Access
| Status | When |
|---|---|
| 401 | Not authenticated |
| 403 | Authenticated but not allowed |
| 404 | Hide existence (sensitive resources) |
7. Implementing Owner-Based Access Control
Example: Owner Check
public Order findOrderForUser(Long orderId, Long userId) {
Order order = repo.findById(orderId)
.orElseThrow(() -> new NotFoundException());
if (!order.getUserId().equals(userId)) {
throw new ForbiddenException();
}
return order;
}8. Implementing Hierarchical Permissions
| Hierarchy | Example |
|---|---|
| Org → Team → User | Org admin sees all team data |
| Folder → File | Permissions inherited from parent |
| Tenant → Workspace | Tenant admin manages all workspaces |
9. Implementing Fine-Grained Permissions
| Tool | Model |
|---|---|
| Google Zanzibar / SpiceDB | Relationship-based (ReBAC) |
| Open Policy Agent (OPA) | Policy-as-code (Rego) |
| AWS Cedar | Declarative policy language |
| Casbin | Multi-model (RBAC, ABAC) |
10. Caching Authorization Decisions
| Strategy | Trade-off |
|---|---|
| Cache permission lookups | Faster; staleness on revoke |
| Short TTL (1-5 min) | Limits stale-window |
| Push invalidation | Real-time; complexity |
| Cache per user+resource | Granular but memory-heavy |